Register Identity Provider

Create or update an identity provider.

PUT/tenants/{tenantId}/idps/{name}

Use it in a workflow

Add a step and choose the Salesforce Commerce Cloud connector.
Pick the Register Identity Provider action (under Auth Admin).
Fill in the fields below, then reference the result from later steps as {{registerIdentityProvider.response.data}}.

Request

Path parameters

namestringrequired

tenantIdstringrequired

Request body

Enter the body as JSON in the step's Body field.

namestringrequired

Identity Provider Name

One ofadfsappleauth0azurecognitofacebookforgerockgigyagigya_socialgoogleoktapingsalesforce

authUrlstringrequired

IDP authorize URL

tokenUrlstringrequired

IDP token URL

tokenInfoUrlstringrequired

IDP token info URL

userInfoUrlstringrequired

IDP user info URL

redirectUrlstringrequired

Redirect URL to go to after IDP flow is complete. This URL must be registered with the IDP.

wellKnownUrlstringrequired

IDP URL to get OIDC configuration.

clientIdstringrequired

Client Id of the third party IDP.

clientSecretstringrequired

Client Secret of the third party IDP. For Apple copy the contents from the .p8 file that was downloaded from Apple between -*----BEGIN PRIVATE KEY-----* and -*---END PRIVATE KEY-----* markers.

preferenceValueboolean

Set the IDP configuration as the Preferred SLAS IDP. Default value is `false`.

isClientCredsBodybooleanrequired

Default is to place the client credentials in a basic authorization header for the call to the IDP. If true, the client credentials are placed in the POST body to the IDP.

useWellKnownboolean

If set to `true`, SLAS uses the `wellKnowUrl` value to populate the `authUrl`, `tokenUrl`, `userInfoUrl`, and `scopes` values from the identity provider. Default value is `false`.

scopesarray<string>required

IDP Scopes

teamIdstring

Apple Team Id. Used primarily for Sign with Apple in generating the client secret.

keyIdstring

Apple key id. This is the Key ID that was obtained from Apple when the the private key for client authentication was created. Used primarily for Sign with Apple in generating the client secret.

loginMergeClaimsarray<string>

List of user info claims that can be used as identifiers to look up and merge with an existing B2C Commerce profile for a registered shopper or an existing B2C Commerce profile created via federated login with an external Identity Provider with the same merge claim as this one. If multiple matching B2C Commerce shopper (customer) profiles are found, the external profile is merged with the most recently created shopper (customer) profile. Refer to the Merge Shopper Profiles user guide for more details. Note: When configuring an Apple IDP, 'email' and 'sub' are the only supported merge claims.

oidcClaimMapperarray<string>

Mapping from the identity provider’s token claims for SLAS to get user information values when the user successfully authenticates. The values in this array should be setup using the following `key=value` pair pattern. The key part is the SLAS key with the value part being the OIDC claim key.

json

{
  "name": "google",
  "authUrl": "https://www.salesforce.com/authorize",
  "tokenUrl": "https://www.salesforce.com/token",
  "tokenInfoUrl": "https://www.salesforce.com/introspect",
  "userInfoUrl": "https://www.salesforce.com/userinfo",
  "redirectUrl": "https://www.salesforce.com/idp/callback",
  "wellKnownUrl": "https://www.salesforce.com/.well-known/openid-configuration",
  "clientId": "934277749308-02dg4398n3s31ofge8cot46jirn3kpkf.apps.googleusercontent.com",
  "clientSecret": "aKZM1xEnZopNP2bm2gc3GKex",
  "isClientCredsBody": false,
  "scopes": [
    "oidc",
    "email",
    "profile"
  ],
  "preferenceValue": true
}

Response

Returns 200 with an object. Read it in later steps with {{registerIdentityProvider.response.data.<field>}}.

namestring

Identity Provider Name

authUrlstring

IDP authorization URL

tokenUrlstring

IDP token URL

tokenInfoUrlstring

IDP token info URL

userInfoUrlstring

IDP user info URL

redirectUrlstring

Redirect URL to go to after IDP flow is complete. This URL must be registered with the IDP.

wellKnownUrlstring

IDP to get OIDC configuration.

clientIdstring

Client Id of the third party IDP.

clientSecretstring

Client Secret of the third party IDP. For Apple copy the contents from the .p8 file that was downloaded from Apple between -*----BEGIN PRIVATE KEY-----* and -*---END PRIVATE KEY-----* markers.

isPreferredboolean

Indicates if the IDP configuration is the Preferred SLAS IDP for the Tenant Id.

isClientCredsBodyboolean

Default is to place the client credentials in a basic authorization header for the call to the IDP. If true, the client credentials are placed in the POST body to the IDP.

scopesarray<string>

Scopes needed by the IDP.

teamIdstring

Apple Team ID. Used primarily for Sign with Apple in generating the client secret.

keyIdstring

Apple key ID. This is the Key ID that was obtained from Apple when the the private key for client authentication was created. Used primarily for Sign with Apple in generating the client secret.

loginMergeClaimsarray<string>

oidcClaimMapperarray<string>

json

{
  "name": "google",
  "authUrl": "https://www.salesforce.com/authorize",
  "tokenUrl": "https://www.salesforce.com/token",
  "tokenInfoUrl": "https://www.salesforce.com/inspect",
  "userInfoUrl": "https://www.salesforce.com/userinfo",
  "redirectUrl": "https://www.salesforce.com/idp/callback",
  "clientId": "934277749308-02dg4398n3s31ofge8cot46jirn3kpkf.apps.googleusercontent.com",
  "clientSecret": "aKZM1xEnZopNP2bm2gc3GKex",
  "isPreferred": true,
  "isClientCredsBody": false,
  "scopes": [
    "oidc",
    "email",
    "profile"
  ],
  "wellKnownUrl": "https://www.salesforce.com/.well-known/openid-configuration"
}

Need more? See the Salesforce Commerce Cloud guide for connection setup and behaviour shared by every action.

Was this page helpful?